Nice read.

If you are the only user of your Immich instance, you can put it behind Tailscale and block outside traffic altogether.

I’ve recently set up Immich as well, but on my own infrastructure, with Tailscale for access from outside my home network